netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-hrc4-p2h3-pjqw
GHSA-hrc4-p2h3-pjqw
This commit is contained in:
advisory-database[bot]
2025-03-20 18:15:00 +00:00
parent c6177c1cf0
commit 22346a318e
2 changed files with 162 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/03/GHSA-hrc4-p2h3-pjqw/GHSA-hrc4-p2h3-pjqw.json
+162
View File
@@ -0,0 +1,162 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hrc4-p2h3-pjqw",
"modified": "2025-03-20T18:13:27Z",
"published": "2025-03-19T21:30:52Z",
"aliases": [
"CVE-2025-2536"
],
"summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)",
"details": "Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's layout-taglib/__liferay__/index.js allows remote attackers to inject arbitrary web script or HTML via toastData parameter",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2024.Q2.0"
},
{
"last_affected": "2024.Q2.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.4.3.82"
},
{
"fixed": "7.4.3.129"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2024.Q1.1"
},
{
"fixed": "2024.Q1.13"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2023.Q4.0"
},
{
"fixed": "2024.Q4.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2023.Q4.10"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2023.Q3.1"
},
{
"fixed": "2024.Q4.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2023.Q3.10"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2024.Q3.0"
},
{
"fixed": "2024.Q3.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2536"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-2536"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-03-20T18:13:27Z",
"nvd_published_at": "2025-03-19T19:15:50Z"
}
}
advisories/unreviewed/2025/03/GHSA-hrc4-p2h3-pjqw/GHSA-hrc4-p2h3-pjqw.json
-36
View File
@@ -1,36 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hrc4-p2h3-pjqw",
"modified": "2025-03-19T21:30:52Z",
"published": "2025-03-19T21:30:52Z",
"aliases": [
"CVE-2025-2536"
],
"details": "Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's layout-taglib/__liferay__/index.js allows remote attackers to inject arbitrary web script or HTML via toastData parameter",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2536"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-2536"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-19T19:15:50Z"
}
}